Remark 2 We emphasize that even though we call this attack “weak” this is the attack model considered in several prior works [1]}, [2]}. Furthermore, to our best knowledge most of them have not considered the adversarial problem from the lens of detection.

